Loading vulnerability details...
When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead.
Example:
import { generate } from 'astring'
import { valueToEstree } from 'estree-util-value-to-estree'
const estree = valueToEstree({
['__proto__']: {}
})
const code = generate(estree)
console.log(code)
Output:
{
"__proto__": {}
}
This was fixed in version 3.3.3.
If you control the input, don’t specify a property named __proto__. If you don’t control the output, strip any properties named __proto__ before passing it to valueToEstree.
When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead.
Example:
import { generate } from 'astring'
import { valueToEstree } from 'estree-util-value-to-estree'
const estree = valueToEstree({
['__proto__']: {}
})
const code = generate(estree)
console.log(code)
Output:
{
"__proto__": {}
}
This was fixed in version 3.3.3.
If you control the input, don’t specify a property named __proto__. If you don’t control the output, strip any properties named __proto__ before passing it to valueToEstree.
This medium-severity vulnerability could be exploited under certain conditions to compromise security controls or access sensitive information. Should be addressed in a timely manner.
Probability of exploitation in the next 30 days · more likely than 36.9% of all CVEs.
Apply security patches to version 3.3.3 immediately
Isolate affected systems from untrusted networks until patching is complete
Implement enhanced monitoring for exploitation attempts and unusual behavior